www.registrar.berkeley.edu

Why it matters

Content Security Policy (CSP) limits where scripts, styles, frames, and other browser content may come from. A strong policy reduces the impact if an attacker manages to inject content into a page.

What to do

Define only the sources the application needs, test the policy before activating it, and avoid broad wildcard (*) rules, unsafe-inline, and unsafe-eval where possible.

Scope of this check

This check only evaluates the homepage response and content that the scanner could reach. Other pages and sign-in flows may use different settings.

Evidence and check scope

Configured:

No

Response inspected:

Homepage HTML response

Host requested:

www.registrar.berkeley.edu

Host observed:

www.registrar.berkeley.edu

References

Why it matters

Another website can place this page inside a hidden or misleading frame and trick a user into clicking an unintended action. Frame restrictions tell browsers which sites, if any, may embed the page.

What to do

Set frame-ancestors in CSP to the required trusted sites, and keep X-Frame-Options for older browsers when appropriate.

Why it matters

Without the nosniff setting, a browser may guess a file's type and treat harmless-looking content as executable code. This can turn an incorrect Content-Type into a security issue.

What to do

Send X-Content-Type-Options: nosniff on every response and return an accurate Content-Type.